Private
Authentication and document or workspace permissions control access.
Security and trust
Know what a link means before you publish it.
HTML Docs supports private collaboration, link sharing, and public publishing. These controls solve different problems. This page explains the boundaries plainly—including the risks of executable HTML.
Shared by link
The URL or token is the access secret. Keep it out of public channels.
Published, noindex
Anyone with the URL can open it, but search indexing is disabled by default.
Public and listed
The owner explicitly opts into Artifacts discovery and search indexing.
Executable content
Treat HTML as code, because it is.
Published HTML can include JavaScript, remote assets, forms, and interactive libraries. That flexibility is why an AI artifact can be more useful than a screenshot—and why the source deserves review.
Publish only content you trust. Remove API keys, credentials, private datasets, internal endpoints, and any secret embedded in markup or scripts. A browser-delivered secret is not a secret.
Practical boundary
Use HTML Docs for reviewable artifacts. Use a production deployment platform and your normal application-security process for software with backend services, sensitive runtime data, or uptime requirements.
Team and enterprise controls
Roles and permissions
Separate owner, editor, commenter, and viewer responsibilities around documents and folders.
Workspace boundaries
Keep governed company documents inside a shared workspace rather than personal libraries.
Domain controls
Verify company domains and apply external-sharing rules to enterprise workflows.
SAML SSO
Connect a supported SAML 2.0 identity provider for managed employee access.
Audit events
Record workspace, membership, identity, and sharing changes for administrator review.
Private sites
Require authenticated folder access and return noindex, nofollow headers with private caching.
Security and indexing FAQ
Are standalone published pages indexed by default?
No. A standalone page is noindex by default. Its owner must explicitly list it in Artifacts and open it to search indexing. Obvious test and QA slugs remain excluded.
Does a noindex page become private?
No. Noindex controls search discovery, not access. Anyone who has a public published URL may still open it. Use private access for confidential material.
Can published HTML execute JavaScript?
Yes. Published artifacts can preserve browser interactions and scripts. Treat HTML as executable code, review it before publishing, and never embed credentials or private secrets.
Does HTML Docs claim a compliance certification?
This page does not claim SOC 2, ISO 27001, HIPAA, or another certification. Enterprise buyers should validate required controls during rollout planning.
Planning a governed rollout? Use the enterprise contact form to discuss your identity, access, retention, and review requirements.